# Indirect PI — Medical / Genetic Data Exfiltration via Agent Action

- **Severity:** Critical
- **Signature ID:** `6d6ee7b1-603f-48bb-9d27-693f1d5f0bde`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI07 (Unsafe Autonomous Code Execution), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

Attackers hide commands inside ordinary-looking content — a product review, a note, a profile field — that an AI agent reads while doing some unrelated task. Those hidden commands tell the agent to find and send out health records, genetic test results, lab reports, or diagnostic files.

## How the attack works

An AI agent is given a routine task, such as reading reviews or processing profile data. Somewhere in that data an attacker has planted text written to look like an instruction rather than content — this is indirect prompt injection. The hidden instruction tells the agent to locate sensitive files such as medical records, health system exports, 23andMe genetic data, or lab and diagnostic reports, then download and send them somewhere outside the organization. Because the agent trusts the data it's processing as part of its normal workflow, it can carry out these steps without anyone noticing until the data is already gone.

## Why it matters

An organization can lose highly sensitive health or genetic data on patients or employees, triggering privacy law violations, regulatory penalties, and loss of trust — without any human ever approving the transfer.

## What you can do

- Treat any text an agent reads from external or user-supplied sources (reviews, notes, profiles) as untrusted input, not as instructions.
- Restrict agents so they cannot read health, genetic, or medical files unless the current task explicitly requires it.
- Require human approval before an agent sends files or data to any external destination.
- Log and review agent actions that involve exfiltrating documents, especially after processing third-party or user-submitted content.

## Known benign look-alikes

- Healthcare providers legitimately retrieving and emailing patient records at patient request
- Patient portal integrations that send health summaries to verified patient emails

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00704

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-medical-genetic-data-exfiltration-via-agent-acti